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Protecting content from illicit reproduction by proof of existence of a complete data set via 
self-referencing sections 



1 . Field of the Invention 

This invention relates primarily to the field of consumer electronics, and in particular to the 
protection of copy-protected content material. 

2. Description of Related Art 

5 The illicit distribution of copyright material deprives the holder of the 

copyright legitimate royalties for this material, and could provide the supplier of this illicitly 
distributed material with gains that encourage continued illicit distributions. In light of the 
ease of information transfer provided by the Internet, content material that is intended to be 
copy-protected, such as artistic renderings or other material having limited distribution rights, 

10 are susceptible to wide-scale illicit distribution. The MP3 format for storing and transmitting 
compressed audio files has made the wide-scale distribution of audio recordings feasible, 
because a 30 or 40 megabyte digital audio recording of a song can be compressed into a 3 or 
4 megabyte MP3 file. Using a typical 56 kbps dial-up connection to the Internet, this MP3 
file can be downloaded to a user's computer in a few minutes. Thus, a malicious party could 

15 read songs from an original and legitimate CD, encode the songs into MP3 format, and place 
the MP3 encoded song on the Internet for wide-scale illegitimate distribution. Alternatively, 
the malicious party could provide a direct dial-in service for downloading the MP3 encoded 
song. The illicit copy of the MP3 encoded song can be subsequently rendered by software or 
hardware devices, or can be decompressed and stored onto a recordable CD for playback on a 

20 conventional CD player. 

A numbenof schemes have been proposed for limiting the reproduction of 
copy-protected content material. The Secure Digital Music Initiative (SDMI) and others 
advocate the use of "digital watermarks" to identify authorized content material. EP 0981901 
"Embedding auxiliary data in a signal" issued 1 March 2000 to Antonius A.C.M. Kalker, 

25 discloses a technique for watermarking electronic material. As in its paper watermark 

counterpart, a digital watermark is embedded in the content material so as to be detectable, 
but unobtrusive. An audio playback of a digital music recording containing a watermark, for 
example, will be substantially indistinguishable from a playback of the same recording 
without the watermark. A watermark detection device, however, is able to distinguish these 
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two recordings based on the presence or absence of the watermark. Because some content 
material may not be copy-protected and hence may not contain a watermark, the absence of a 
watermark cannot be used to distinguish legitimate from illegitimate material. On the 
contrary, the absence of a watermark is indicative of content material that can be legitimately 
5 copied freely. 

Other copy protection schemes are also available. For example, European 
patent EP0906700, "Method and system for transferring content information and 
supplemental information related thereto", issued 7 April 1999 to Johan P.M.G., presents a 
technique for the protection of copyright material via the use of a watermark "ticket" that 

1 0 controls the number of times the protected material may be rendered. 

An accurate reproduction of watermarked material will cause the watermark to 
be reproduced in the copy of the watermarked material. An inaccurate, or lossy reproduction 
of watermarked material, however, may not provide a reproduction of the watermark in the 
lossy copy of the material. A number of protection schemes, including those of the SDMI V 

15 have taken advantage of this characteristic of lossy reproduction to distinguish legitimate , 
material from illegitimate material, based on the presence or absence of an appropriate 
watermark. In the SDMI scenario, two types of watermarks are defined: "robust" 
watermarks, and "fragile" watermarks. A robust watermark is one that is expected to survive 
a lossy reproduction that is designed to retain a substantial portion of the original content ... 

20 material, such as an MP3 encoding of an audio recording. That is, if the reproduction retains 
sufficient information to allow a reasonable rendering of the original recording, the robust 
watermark will also be retained. A fragile watermark, on the other hand, is one that is 
expected to be corrupted by a lossy reproduction or other illicit tampering. 

In the SDMI scheme, the presence of a robust watermark indicates that the 

25 content material is copy protected, and the absence or corruption of a corresponding fragile 
watermark when a robust watermark is present indicates that the copy protected material has 
been tampered with in some manner. An SDMI compliant device is configured to refuse to 
render watermarked material with a corrupted watermark, or with a detected robust 
watermark but an absent fragile watermark, except if the corruption or absence of the 

30 watermark is justified by an "SDMI-certified" process, such as an SDMI compression of 

copy protected material for use on a portable player. For ease of reference and understanding, 
the term "render" is used herein to include any processing or transferring of the content 
material, such as playing, recording, converting, validating, storing, loading, and the like. 
This scheme serves to limit the distribution of content material via MP3 or other compression 
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techniques, but does not affect the distribution of counterfeit unaltered (uncompressed) 
reproductions of content material. This limited protection is deemed commercially viable, 
because the cost and inconvenience of downloading an extremely large file to obtain a song 
will tend to discourage the theft of uncompressed content material. 
5 It is an object of this invention to extend the protection of copy-protected 

material to include the protection of uncompressed content material. 

This object and others are achieved by selecting a sufficient number of data 
items for inclusion in a data set so as to discourage a transmission of the entire set over a 
limited bandwidth communications path, such as the Internet. Each data item comprises one 
1 0 or more sections, and the totality of sections constitute the complete data set. Each section of 
the data set contains a watermark that includes an identifier of the section, and an identifier of 
the data set. In a preferred embodiment, the identifier of the section is the address of the 
section, and the identifier of the data set is a serial number and an indicator of the total size of 
the data set. The presence of the data set is confirmed by checking the watermarks of 
15 randomly selected sections to verify that the original section that formed the data set is 
present. If a section is discovered to be missing or altered, subsequent processing of data 
items of the data set is prevented. In a preferred embodiment, the identifiers are stored as a 
combination of robust and fragile watermarks. 

The invention is explained in further detail, and by way of example, with 
20 reference to the accompanying drawings wherein: 

FIG. 1 illustrates an example system for protecting copy-protected content 
material in accordance with this invention. 

FIG. 2 illustrates an example data structure that facilitates a determination of 
the presence of an entirety of a data set in accordance with this invention. 
25 FIG. 3 illustrates an example alternative data structure that facilitates a 

determination of the presence of an entirety of a data set in accordance with this invention. 

FIG. 4 illustrates an example flow diagram for creating a data set with security 
items that facilitate a determination of the presence of an entirety of the data set in 
accordance with this invention. 
30 FIG. 5 illustrates an example flow diagram of a decoding system for rendering 

content material in dependence upon the presence of an entirety of a data set in accordance 
with this invention. 

Throughout the drawings, the same reference numerals indicate similar or 
corresponding features or functions. 
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For ease of understanding, the invention is presented herein in the context of 
digitally recorded songs. As will be evident to one of ordinary skill in the art, the invention is 
applicable to any recorded information that is expected to be transmitted via a limited 
bandwidth communications path. For example, the individual content material items may be 
5 data records in a larger database, rather than songs of an album. 

The theft of an item can be discouraged by making the theft more time 
consuming or inconvenient than the worth of the stolen item. For example, a bolted-down 
safe is often used to protect small valuables, because the effort required to steal the safe will 
typically exceed the gain that can be expected by stealing the safe. Copending U.S. patent 

1 0 application "Protecting Content from Illicit Reproduction by Proof of Existence of a 

Complete Data Set", U.S. serial number 09/537079, filed 28/3/00 for Michael A. Epstein, 
Attorney Docket PHUS000088, teaches selecting and binding data items to a data set that is 
sized sufficiently large so as to discourage a transmission of the data set via a bandwidth 
limited communications system, such as the Internet, and is incorporated by reference herein. 

1 5 This copending application teaches a binding of the data items in the data set by creating a 
watermark that contains a data-set-entirety parameter and embedding this watermark into 
each section of each data item. The copending application also teaches including a section- 
specific parameter (a random number assigned to each section) in the watermark. The 
referenced copending application teaches the use of "out of band data" to contain the entirety 

20 parameter, or information that can be used to determine the entirety parameter. The section 
watermarks are compared to this entirety parameter to assure that they are the same sections 
that were used to create the data set and this entirety parameter. To minimize the likelihood 
of forgery, the entirety parameter is based on a hash of a composite of section-specific 
identifiers. The referenced copending application also teaches the use of digitally signed 

25 certificates and other techniques that rely on cryptographic techniques, such as hashing and 
the like. 

Copending U.S. patent application "Protecting Content from Illicit 
Reproduction by Proof of Existence of a Complete Data Set via a Linked List", U.S. serial 
number 09/537,079, filed March 28, 2000 for Antonius A. M. Staring and Michael A. 
30 Epstein, Attorney Docket US000088, teaches a self-referential data set that facilitates the 

determination of whether the entirety of the data set is present, without the use of out of band 
data and without the use of cryptographic functions, such as a hash function. This copending 
application creates a linked list of sections of a data set, encodes the link address as a 
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watermark of each section, and verifies the presence of the entirety of the data set by 
verifying the presence of the linked-to sections of some or all of the sections of the data set. 

In this invention, each section of a data set is uniquely identified and this 
section identifier is associated with each section in a secure manner. To assure that a 
5 collection of sections are all from the same data set, an identifier of the data set is also 
securely encoded with each section. Preferably, the section identifier and the data set 
identifier are encoded as a watermark that is embedded in each section, preferably as a 
combination of robust and fragile watermarks. Using exhaustive or random sampling, the 
presence of the entirety of the data set is determined, either absolutely or with statistical 

1 0 certainty. If the entirety of the data set is not present, subsequent processing of the data items 
of the data set is terminated. In the context of digital audio recordings, a compliant playback 
or recording device is configured to refuse to render an individual song in the absence of the 
entire contents of the CD. The time required to download an entire album on a CD in 
uncompressed digital form, even at DSL and cable modem speeds, can be expected to be 

15 greater than an hour, depending upon network loading and other factors. Thus, by requiring 
that the entire contents of the CD be present, at a download "cost" of over an hour, the 
likelihood of a theft of a song via a wide-scale distribution on the Internet is substantially 
reduced. 

FIG. 1 illustrates an example block diagram of a protection system 100 in 
20 accordance with this invention. The protection system 100 comprises an encoder 110 that 
encodes content material onto a medium 130, and a decoder 120 that renders the content 
material from the medium 130. The encoder 110 includes a selector 112 that selects content 
material from a source, a binder 116 that builds an entirety verification structure, and a 
recorder 1 14 that records the content material with the entirety verification structure onto the 
25 medium 130. The selector 1 12, for example, may be configured to select content information 
corresponding to songs that are being compiled into an album. Each selected content material 
item is termed a data item; each data item includes one or more sections of data comprising 
the data item. The binder 1 16 is configured to bind each section to the data set, to facilitate a 
determination of whether the entirety of the data set is present when a data item of the data 
30 set is presented for rendering, for example, when a selected song is presented to a rendering 
device for playback. The recorder 114 appropriately formats, encodes, and stores the 
information on the medium 130, using techniques common in the art. 

In accordance with this invention, the selector 112 selects data items to be 
added to the data set until the size of the data set is deemed large enough to discourage a 
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subsequent transmission of the data set via a limited bandwidth communications channel. 
This "discouraging size" is a subjective value, and will depend upon the assumed available 
communications bandwidth, the loss incurred by the transmission, and so on. Other criteria 
may also be used to determine whether to add additional data items to the data set. For 
5 example, if the data items correspond to songs of an existing album collection, all of the 

songs will typically be added to the data set, regardless of whether the size of the data set has 
exceeded the determined discouraging size. If all of the songs of the album collection have 
been selected, and the discouraging size criterion has not yet been reached, other data items 
are selected to accumulate the required discouraging size. For example, data items 

10 comprising random data bits may be added to the data set to increase its size. These random 
bits will typically be stored as out of band data, CD-ROM data, and the like, to prevent it 
from being rendered as audible sounds by a conventional CD player. Alternatively, the data 
items may comprise other sample songs that are provided to encourage the sale of other 
albums, or images and video sections related to the recorded content material. Similarly, 

1 5 promotional material, such as Internet access subscription programs may also be included in 
the recorded information on the recorded medium. These and other means of adding size to a 
data set will be evident to one of ordinary skill in the art in view of this invention. In 
accordance with this invention, the encoder 1 10 includes a binder 1 16 that creates a unique 
identifier for each section, and an identifier for the entirety of the data set. In a preferred 

20 embodiment, the identifier of each section is the address that is used for accessing the 

particular section. The data set identifier can be any somewhat-unique identifier that reduces 
the likelihood of different data sets having the same identifier, thereby reducing the 
likelihood of an illicit substitution of sections from different data sets. In a preferred 
embodiment, for example, the data set identifier includes a 64 bit random number, and a 

25 parameter that can be used to determine the total size of the data set. The binder 116 

communicates the data set identifier and the unique identifier of each section to the recorder 
1 14 for recording onto the medium 130. 

Preferably, the recorder records the data set identifier and the unique identifier 
of each section as one or more watermarks that are embedded in each section. In a preferred 

30 embodiment, the section identifier and data set identifier are encoded as combination of a 

robust watermark and a fragile watermark. In this manner, a removal of the robust watermark 
will cause damage to the section, and a modification of the section will cause damage to the 
fragile watermark. Preferably, the data set identifier is encoded as a fragile watermark, and 
the section identifier is encoded as a robust watermark, because robust watermarks consume 
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more resources, and the section identifier typically requires fewer bits than the data set 
identifier. In an alternative preferred embodiment, the aforementioned parameter that 
facilitates a determination of the size of the data set is encoded as a robust watermark and the 
remainder of the data set identifier and section identifier are encoded as fragile watermarks. 
5 Alternative combinations of robust and fragile watermarks may also be used, as would be 
evident to one of ordinary skill in the art in view of this invention. For example, the total size 
of the data set may form the bulk of the data set identifier. Or, the data set identifier or total 
size of the data set may be encoded as a robust watermark that extends across multiple 
sections. Other watermarks may also be used in addition to, or in combination with, these 

10 watermarks, including for example, watermark 'tickets" that limit the number of times a data 
set may be copied. Such a watermark ticket may form the aforementioned data set identifier. 
Copending U.S. Patent Application "Copy Protection by Ticket Encryption", serial number 
09/333,628, filed 6/15/99 for Michael Epstein, Attorney docket PHA 23,457, presents 
techniques for the protection of copyright material. 

1 5 The decoder 120 in accordance with this invention comprises a renderer 122 

and a gate 124 that is controlled by an entirety checker 126. The renderer 122 is configured to 
retrieve information from a medium reading device, such as a CD reader 132. As is common 
in the art, the renderer 122 retrieves the information by specifying a location index, and in 
response, the reader 132 provides the data located at the specified location index on the 

20 medium 130. In a typical memory structure comprising tracks iand sections, a section of data 
is retrieved by specifying a section address. 

The dotted lines of FIG. 1 illustrate an example song extractor 142 that 
extracts a song from the medium 130 and communicates it to an example CD imitator 144, 
representative of a possible illicit download of the song via the Internet. The CD imitator 144 

25 represents, for example, a software program that provides information in response to a 
conventional CD-read command. Alternatively, the information received from the song 
extractor can be written to a CD medium, and provided to the conventional CD reader 132. 
As noted above, the song extractor 142 is likely to be used because the transmission of the 
entirety of the contents of the medium 130 is assumed to be discouraged by the purposeful 

30 large size of the contents of the medium 130. 

In accordance with this invention, the entirety checker 126 is configured to 
obtain data from the medium 130, typically via the renderer 122, to determine whether the 
entire data set is present. The renderer 122 is configured to determine the watermark 
associated with each section of data that is read from the medium 130. The entirety checker 
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1 26 uses the watermarks to determine whether the entirety of the data set is available to the 
renderer 122, as discussed below. 

FIG. 2 illustrates an example data structure 200 for storing data items in a data 
set that facilitates a determination of whether the entirety of the original data set is present. A 
5 track T 210 and section S 220 structure is illustrated, consistent with the memory structure of 
conventional CD and other storage media. As illustrated, each track T 210 may have a 
different number of sections S 220. In the example data structure 200, each section contains 
ancillary information 230 that is used by a compliant rendering device to verify that the 
entirety of the data set is present. As discussed above, in accordance with this invention, the 

10 ancillary information 230 of each section S 220 contains a unique identifier of the section and 
a unique identifier of the data set. The unique identifier of the data set is illustrated as the 
CDED 232 parameter that is encoded with each section, as discussed above. The unique 
identifier of each section is illustrated as the track 234 and section 236 identifier of each 
section. FIG. 3 illustrates an alternative data structure 300, wherein the unique identifier 334 

1 5 of each section 220 is a sequential numbering of each section 220, from 0 to N-l , where N 
338 is the total number of sections in the data set. In this example data structure, the value of 
N 338 is included in the ancillary information 230, to facilitate an access to the sections 
ranging from 0 to N-l. Preferably, the ancillary information 230 containing these identifiers 
is encoded as a combination of robust and fragile watermarks that are embedded with each 
- 20 section 220. ; 

FIG. 4 illustrates an example flow diagram for creating the example data 
structure 300 of FIG. 3. The loop 410-435 accumulates data items to form a data set that is 
sufficient large so as to discourage a transmission of the data set via a limited bandwidth 
communications channel, such as a download from the Internet. As each data item is 

25 selected, at 41 0, each section comprising the data item is assigned a section number that is 
used to identify the section, at 420, and its size is added to the accumulated size of the data 
set, at 430. After accumulating a sufficiently sized data set, at 435, a somewhat-unique data 
set identifier is created, at 440, as discussed above. In a preferred embodiment, the section 
identifier and data set identifier are bound to each section using a security item, such as a 

30 watermark, a checksum parameter, an encrypted value, or other parameter or technique, 

common in the art, that facilitates a determination that each section contains the identifiers 
that were originally assigned to it. At 450 of the example flowchart, one or more watermarks 
are created for each section, comprising the section identifier, the data set identifier, and the 
range of available section numbers in this data set. Preferably, the section identifier 
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corresponds to an incremental count of each section as it is added to the data set, so that the 
range value is merely the total number of section numbers in the data set. As noted above, a 
combination of robust and fragile watermarks are preferably used for encoding the 
information associated with each section. The section and its embedded watermark(s) are 
5 recorded onto the recording medium, such as a CD, at 460. 

FIG. 5 illustrates an example flow diagram of the rendering of data items of a 
data set in dependence upon the presence of the entirety of the data set, using the example 
data structure 300 of FIG. 3 to determine the presence of the entirety of the data set. It is 
assumed that the rendering device has detected the presence of copy-protected material, via 

1 0 for example, the detection of a watermark or other marking of the material. At 5 10, the 

highest section number forming the range of 0 to N-l sections is determined, and at 520, a 
random section within this range is selected. Preferably, the range is explicitly encoded in 
each section, as discussed above, although any of a variety of techniques can be used to 
determine the range of sections within the data set, or in other ways identify an access to 

15 sections of the data set. This access identifier, such as the range of the section identifiers, 

may be encoded within each section, within a table of contents of the disk, suitably protected 
from modification using, for example, watermarks. Alternatively, as discussed above, the 
CDID data set identifier may contain this access identifier for identifying the range of 
sections within the data set. In this embodiment, knowing that there is at least one section in 

20 any data set, the first section can be read to determine the data set ID and encoded range; 
alternatively a section from the data item selected for rendering can be used as an initial 
section for reading the data set ID and encoded range. Alternatively, if the minimum size of 
the data sets used in accordance with this invention is known, the range may be set as the 
minimum number of sections required to achieve the minimize sized data set. These and 

25 other techniques for determining a range of section numbers in a data set will be evident to 
one of ordinary skill in the art in view of this invention. At 530, the watermarks of the 
selected random section within the range of section numbers are read to provide the data set 
identifier CDID and the section identifier SID. 

When, at 535, the watermark of the first selected section is read, its data set 

30 identifier CDID becomes, at 550, the data set identifier ID that is used to compare, at 545, 
each of the other CDIDs of sections purported to be from this same data set. At 555, the 
section identifier S that was used to access the selected section is compared to the section 
identifier SID that was read from the watermark of this accessed section S. If, at 555, the 
watermark section identifier SID does not correspond to the access section identifier S, this 



INSDOCID: <WO 0159705A2_L> 



. WO 01/59705 PCT/EP01/00477 

10 

implies that the section numbers have been modified in some manner, and the subsequent 
processing of data from the data set is terminated, at 580. Subsequent randomly selected 
sections are similarly verified, via the loop 565-520, until sufficient confidence is gained that 
the entire data set is present. Each section's CDID is verified, at 545, by comparing it to the 
first CDID that was read, and each section's identifier SID is verified, at 555, by comparing 
to the section identifier S that was used to access the section. In this embodiment, absolute 
confidence can be gained by continuing the loop 520-565 until all sections within the range 
of the data set have been processed. The reading of each watermark, however, is time 
consuming, and a substantial delay before the rendering of a song may be unacceptable to 
consumers. In a preferred embodiment, the rendering of the song begins immediately after a 
few successful random section verifications. Thereafter, if the rendering system is able to 
read information from the medium faster than is required for rendering the material, 
additional section watermarks are read and verified, and the rendering is terminated if and 
when a mis-match between data set or section identifiers is found. v 

Also in a preferred embodiment, the determination that the entirety of the data 
set is present is deemed completed when the number of random sections tested provide 
sufficient confidence that the entirety of the data set is present, with substantial statistical 
certainty. That is, for example, if only half the data set is actually present, the random 
selection of any section is likely to detect an absence of the section 50% of the time. The 
likelihood of not detecting the absence of half the data set after k random section selections 
and verifications is (l/2) k . Each successive test increases either the confidence level or the 
expected proportion of the data set being present, or both. Statistical tests are commonly 
available for determining an appropriate number of section verifications to achieve a desired 
level of confidence that a given proportion of the data set is present. In a typical embodiment, 
the verification of at least five randomly selected pairs is considered sufficient to determine 
the presence or absence of the entirety of the data set. 

In an alternative embodiment, the number of sections verified is proportional 
to the size of the selection being rendered, so that the resources required to effect the 
verification can be allocated appropriately. In a straightforward embodiment of this 
technique, as each section is presented for rendering, a verification of a random section is 
performed. If the rendering device is sufficiently fast, multiple random sections can be 
verified with each rendered section. By coupling the reading of random sections to the 
presentation of select sections for rendering, longer data items will be verified more 
completely than shorter data items. This alternative is particularly well suited for content 
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material whose value is proportional to the size of the data item, or proportional to the 
rendering duration. 

The foregoing merely illustrates the principles of the invention. It will thus be 
appreciated that those skilled in the art will be able to devise various arrangements which, 
5 although not explicitly described or shown herein, embody the principles of the invention and 
are thus within its spirit and scope. For example, the examples presented above illustrate each 
part of the recorded material being part of the data set. In an alternative embodiment, select 
data items, or select parts of data items, may be used to form the data set, for efficiency 
purposes. For example, the tail end of songs may not be part of the "data set" as defined 

10 herein, because the watermark process may be based on a fixed block-size for each 

watermark, or each redundant copy of the watermark. If, for example, the watermark, or 
other parameter, requires ten seconds of a recording for a reliable embedding, the remainder 
of ((the song's length) modulo (10 seconds)) will be recorded on the medium, but not 
included in the "data set" whose entirety is being checked. In like manner, some promotional 

1 5 material may be included on the recorded medium, but purposely excluded from the data set, 
so that it may be freely copied and rendered elsewhere. Note also that the example flow 
diagrams are presented for ease of understanding, and the particular arrangement and 
sequence of steps are presented for illustration. For example, simple equalities are illustrated 
in the decision blocks for determining correspondence, whereas depending upon the 

20 particular techniques used to encode or decode the parameters, the assessment as to whether 
the read item corresponds to a determined item can include a variety of intermediate 
processes. These processes may include, for example, a decryption of items based on 
particular keys, fuzzy logic or statistical testing to determine if two values are "close enough" 
to imply a correspondence, and the like. Variations such as these and others will be evident to 

25 one of ordinary skill in the art in view of this invention, and are included in the spirit and 
scope of the following claims. 
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CLAIMS: 



1 . A method for discouraging a theft of content material comprising: 
collecting (410-435) a plurality of data items (210) comprising the content 

material to form a data set that is sized to be sufficiently large so as to discourage a 
subsequent transmission of the data set via a limited bandwidth communications channel, 
5 each of the plurality of data items (210) comprising one or more 

sections (220), 

each section of the plurality of data items (210) having a self- 
referencing section identifier (334), 

assigning (440) a data set identifier (232) to the data set, 
10 creating (450) one or more security items associated with each section of the 

plurality of data items (210) that include the data set identifier (232) and the section identifier 
(334), to facilitate a subsequent detection of an absence of an entirety of the data set based on 
a verification of the data set identifier (232) and the section identifier (334) of a plurality of 
sections (220). 

15 

2. The method of claim 1, wherein creating one or more security items includes 
creating (450) one or more watermarks that are embedded within each section of the plurality 
of sections (220). 

20 3. The method of claim 2, wherein the one or more watermarks include: 

a robust watermark that is embedded in the section such that a removal of the 

robust watermark causes a corruption of data contained in the section, and 

a fragile watermark that is embedded in the section such that a modification of 

the data contained in the section causes a corruption of the fragile watermark. 



25 



4. The method of claim 2, wherein the one or more watermarks include an access 

identifier (338) that facilitates a subsequent access to at least one section of the entirety of the 
data set. 
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5, The method of claim 2, wherein the one or more watermarks include a ticket 
that facilitates a control of subsequent renderings of the content material. 

6. A method of decoding content material from a source comprising: 

5 reading (530) a first data set identifier (232) and a first section identifier (334) 



associated with a first section of a data set, 

reading (530) a second data set identifier (232) and a second section identifier 
(334) associated with a second section of the data set, 

rendering (570) subsequent sections (220) of the data set in dependence upon a 
10 correspondence (545) between the first data set identifier (232) and the second data set 
identifier (232). 

7. The method of claim 6, wherein at least one of the first data set identifier 
(232), the first section identifier (334), the second data set identifier (232), and the second 

1 5 section identifier (334) is included in one or more watermarks that are associated with at least 
one of the first section and the second section. 

8. The method of claim 6, wherein rendering (570) subsequent sections (220) of 
the data set is in further dependence upon a correspondence (555) between the second section 

20 identifier (334) and a section address associated with the second section of the data set. 

9. The method of claim 6, wherein 

the first section corresponds to a section of a data item that is selected for 

rendering, and 

25 the second section is selected for reading based on a random selection process 

that is dependent upon a receipt of the first section. 

10. The method of claim 6, further including 

reading (530) subsequent data set identifiers and section identifiers associated 
30 with other sections (220) of the data set, wherein 

the rendering (570) of subsequent sections (220) of the data set is in further 
dependence upon a correspondence between the first data set identifier (232) and the 
subsequent data set identifiers (232). 
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11. A storage medium (130) that is configured to contain content material, the 
storage medium (130) comprising a data structure (200, 300) that includes: 

a plurality of sections (220), each section of the plurality of sections (220) 
having at least one security item that associates the section to a data set, wherein 
5 the at least one security item includes a data set identifier (232) and a self- 

referencing section identifier (334) that facilitate a determination of whether an entirety of 
the data set is present on the storage medium (130). 

12. An encoder (110) comprising: 

10 a selector (112) that is configured to select data items (210) comprising a data 

set so that an accumulated size of the data set is sufficient to discourage a transmission of the 
data set via a limited bandwidth communications channel, 

a binder (116) that is configured to associate a data set identifier (232) and a 
self-referencing section identifier (334) to each section of the data items (210) comprising the 

1 5 data set, and 

a recorder (114) that is configured to record each section and associated data 
set identifier (232) and section identifier (334) to a medium to facilitate a subsequent 
rendering of the data items (210) in dependence upon the data set identifier (232) and section 
identifier (334) of a plurality of sections (220). 

20 

13. A decoder (120) comprising: 

a renderer (122) that is configured to receive a plurality of data items (210) 
corresponding to a data set, and to produce therefrom a rendering corresponding to a select 
data item, 

25 each data item of the plurality of data items (210) including one or 

more sections (220), thereby forming a plurality of sections (220) comprising the data set, 

each section of the plurality of sections (220) including a section 
identifier (334) corresponding to the section and a data set identifier (232) 

an entirety checker (126), operably coupled to the Tenderer (122), that is 
30 configured to preclude the rendering corresponding to the select data item in dependence 

upon the section identifier (334) and data set identifier (232) of two or more sections (220) of 
the plurality of sections (220). 
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